DragonForce Ransomware Profile: From Affiliate Program to Cybercrime Cartel

DragonForce is a financially motivated ransomware operation that began in August 2023, initially leveraging leaked LockBit 3.0 code and later adopting Conti v3-based variants. It operates as a Ransomware-as-a-Service (RaaS) model, offering affiliates an 80% revenue share and management tools. By March 2025, it evolved into a cybercrime cartel providing white-label services. The group targets organizations primarily in the US and UK across sectors such as manufacturing, professional services, retail, healthcare, and technology. They recruit developers and reverse engineers and provide data analysis services to maximize extortion. A notable incident includes a major managed service provider (MSP) breach in May 2025 exploiting SimpleHelp vulnerabilities, leading to cascading compromises across client networks.

• CVE-2021-44228: Apache Log4j2 Remote Code Execution VulnerabilityCriticalVulnerability2021-12-10
• ESXi ransomware: why it is dangerous and how to defend against itMalware2026-11-13
• Dark Web Profile: CyberXeroMalware2026-11-10
• ARTEX: Agentic AsbestosMalware2026-11-06
• Free the Model, Sell the Gateway: Prompt Adware hidden in Jailbreak BundlesMalware2026-11-03